CWE-284 · Improper Access Control (page 47)
Page 47 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-4735 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-47161 | High | 7.8 | 2025-05-15 | Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-47884 | Critical | 9.1 | 2025-05-14 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment vari… |
CVE-2025-43563 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system re… |
CVE-2025-22844 | Medium | 4.3 | 2025-05-13 | Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potentially enable informati… |
CVE-2025-20100 | High | 7.5 | 2025-05-13 | Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged user to potentially e… |
CVE-2025-20076 | Medium | 5.0 | 2025-05-13 | Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potentially enable escalatio… |
CVE-2025-20052 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-45371 | Medium | 6.7 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated user to potentially e… |
CVE-2024-45333 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to potent… |
CVE-2024-43101 | Medium | 5.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an authenticated user… |
CVE-2024-39758 | Medium | 5.9 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allow an authenticated user to potentially e… |
CVE-2025-29973 | High | 7.0 | 2025-05-13 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2024-6364 | Medium | 6.4 | 2025-05-13 | A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to th… |
CVE-2025-31260 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31258 | Medium | 6.5 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31247 | High | 7.5 | 2025-05-12 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker m… |
CVE-2025-31232 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A sandboxed app may be… |
CVE-2025-31212 | Medium | 5.5 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watch… |
CVE-2025-31195 | Medium | 6.3 | 2025-05-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox. |
CVE-2025-30436 | Critical | 9.1 | 2025-05-12 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker may be able to use Sir… |
CVE-2025-4538 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of th… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-28201 | Medium | 6.8 | 2025-05-09 | An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access. |
CVE-2025-4468 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-33072 | High | 8.1 | 2025-05-08 | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
CVE-2025-20223 | Medium | 4.7 | 2025-05-07 | A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that… |
CVE-2025-20190 | Medium | 6.5 | 2025-05-07 | A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbi… |
CVE-2025-20137 | Medium | 4.7 | 2025-05-07 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Swi… |
CVE-2025-29448 | High | 7.5 | 2025-05-07 | Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of ser… |
CVE-2025-46816 | Critical | 9.4 | 2025-05-06 | goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone t… |
CVE-2025-21470 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter. |
CVE-2025-21469 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call. |
CVE-2024-49842 | High | 7.8 | 2025-05-06 | Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions. |
CVE-2025-4333 | Medium | 6.3 | 2025-05-06 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFil… |
CVE-2025-46589 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-46588 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-4310 | Medium | 4.7 | 2025-05-06 | A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic… |
CVE-2025-4305 | Medium | 6.3 | 2025-05-06 | A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/co… |
CVE-2025-4291 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted… |
CVE-2025-45618 | Medium | 6.5 | 2025-05-05 | Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive infor… |
CVE-2025-45617 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45616 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45615 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45614 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45613 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45612 | Critical | 9.8 | 2025-05-05 | Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. |
CVE-2025-45611 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request. |
CVE-2025-45610 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloa… |
CVE-2025-45609 | High | 7.5 | 2025-05-05 | Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45608 | High | 7.5 | 2025-05-05 | Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-4051 | Medium | 6.3 | 2025-05-05 | Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-45237 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-4316 | Medium | 4.3 | 2025-05-05 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy v… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4269 | Medium | 6.5 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2025-4258 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master… |
CVE-2024-48905 | Critical | 9.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. |
CVE-2025-46635 | High | 7.1 | 2025-05-01 | An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the ro… |
CVE-2025-46629 | Medium | 6.5 | 2025-05-01 | Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized confi… |
CVE-2025-46628 | High | 7.3 | 2025-05-01 | Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shel… |
CVE-2025-46566 | Critical | 9.8 | 2025-05-01 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2024-30146 | Medium | 4.1 | 2025-04-30 | Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2025-46331 | Critical | 9.8 | 2025-04-30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Hel… |
CVE-2025-24887 | Medium | 6.3 | 2025-04-30 | OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2025-32376 | Medium | 4.3 | 2025-04-30 | Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can… |
CVE-2025-27134 | High | 8.8 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a p… |
CVE-2025-4119 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Produc… |
CVE-2025-4118 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product His… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-25962 | Critical | 9.8 | 2025-04-29 | An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function |
CVE-2025-4067 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpack… |
CVE-2025-4066 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-4065 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-4036 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/g… |
CVE-2025-32470 | High | 7.5 | 2025-04-28 | A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device. |
CVE-2025-4006 | Medium | 4.7 | 2025-04-28 | A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the c… |
CVE-2025-3978 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/vie… |
CVE-2025-3975 | Medium | 5.3 | 2025-04-27 | A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2025-3969 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-3966 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/hom… |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2025-43947 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modi… |
CVE-2025-3518 | Medium | 4.3 | 2025-04-22 | It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can… |
CVE-2025-28104 | Critical | 9.1 | 2025-04-21 | Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. |
CVE-2025-28367 | Medium | 6.5 | 2025-04-21 | mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerabili… |
CVE-2025-3830 | Medium | 6.3 | 2025-04-20 | A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the… |
CVE-2025-3807 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/co… |
CVE-2025-3798 | Medium | 4.7 | 2025-04-19 | A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php… |
CVE-2025-28233 | Critical | 9.1 | 2025-04-18 | Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Cont… |